OpenSSL Heartbeat Code (opens in new tab)

(github.com)

8 pointsMIT_Hacker11y ago3 comments

3 comments

OpenSSL heartbeat bug patch (CVE-2014-0160):

> A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.

askQi11y ago

Can someone explain which part of the code contains the bug and why it is a bug?

smtddr11y ago

Amelek is being a bit harsh or just plain wrong; I learned a few days ago that checking malloc's return value means almost nothing:

j / k navigate · click thread line to collapse

OpenSSL heartbeat bug patch (CVE-2014-0160):

> A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.

askQi11y ago

Can someone explain which part of the code contains the bug and why it is a bug?

smtddr11y ago

Amelek is being a bit harsh or just plain wrong; I learned a few days ago that checking malloc's return value means almost nothing:

j / k navigate · click thread line to collapse